OWASP’s Juice Shop Practice Site: A Refreshing Reminder

At a time when continuous integration is king and anyone with a web scanner is calling themselves a pen tester, OWASP’s Juice Shop project is a refreshing reminder of the need for creative, out of the box security testers in our software security assurance programs.

With the popularity of agile methodologies and devOps, lengthy software security assurance activities can slow things down. To counter this, lengthy DAST scanning and code reviews have given way to automated security testing. For identifying simple vulnerabilities such as cross-site scripting and SQL injection, this is a good solution and allows organizations to scale their efforts beyond the range of manual testing. However, automated assessment without strong security involvement in the design phase can leave such security flaws as logic errors and weaknesses in complex workflows dangerously undiscovered. In an industry that has tasted the cost-savings of security test automation, adding expensive manual assessments back in to the release process can be a hard sell. And then came OWASP’s Juice Shop.

I was approached by the author of Juice Shop, Björn Kimminich, to do a write-up on the OWASP project. To confess up front, I didn’t know much about his project and readied my scanners for what I thought would be a fun point and shoot session. However, during my initial inspection I XSS’d the search field and a banner popped up telling me that I had completed a challenge.

Challenge accepted!

With a little more digging I found that the site contained an actual score board tracking what I and had not completed. My MLK weekend plans were now aborted and the obsessive security geek in my had taken over.

Fast-forward a lost weekend and a lot of Googling and I’m about ¾ths done with the challenges- which isn’t half bad for a middle-aged security exec. What is remarkable however, is that in spite of the fact there are 39 unique hacking challenges the majority of the exploitable flaws do not show up on a dynamic, authenticated scan! This is fairly serious considering some of these challenges include defrauding the Juice Shop out of money, taking over the admin account, and impersonating the Juice Shop’s CISO. None of these however were found by the several dynamic scanners I ran against the site.

So, what is my take-away from all this? Try running Juice Shop through your current assessment program and see how many of the findings your processes uncover. I suspect you’ll either be beefing up your security design reviews or adding manual pen testing back in to your process. Maybe even both…

Note: If you don’t have the time or technical patience to bring up your own instance, there’s an online practice site by Heroku that will save you the time.